ESXi Local Account Created

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Local Account Created

Detects creation of a local ESXi account. A new account is a separate login that remains after the session that created it. It has no rights until a role is assigned, and it is the first step toward a persistent login on the host.

Rule type: query

Rule indices:

logs-vsphere.log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
Data Source: VMware vSphere
Use Case: Threat Detection
Tactic: Persistence
Resources: Investigation Guide
Rule Type: Custom Query (KQL)
Platform: VMware ESXi
Threat: Ransomware

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Local Account Created

Hostd records Account <name> was created on host <hostname> when an account is added from the Host Client or API. The shell records esxcli system account add. The new account has no role until a later permission change.

Possible investigation steps

Read the account name in message and the user field on the hostd event, which is the account that created it.
Look for a following esxcli system permission set or an Admin role grant for the same account.
Compare the account with the approved list for that host.

False positive analysis

A documented joiner or break-glass account is commonly benign. An unknown account created by root over the Host Client, then granted Admin, deserves review.

Response and remediation

If the account was not approved, remove it with esxcli system account remove --id <name>.
Preserve hostd.log and shell.log for the creating session.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit

data_stream.dataset:vsphere.log and event.module:vsphere and message:("esxcli system account add" or Account and "was created")

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Create Account
- ID: T1136
- Reference URL: https://attack.mitre.org/techniques/T1136/
Sub-technique:
- Name: Local Account
- ID: T1136.001
- Reference URL: https://attack.mitre.org/techniques/T1136/001/

« ESXi SSH Session from vpxuser ESXi Account Granted Admin Role »